hiCalibre - Privacy Policy
Last updated: 22 July 2026
This Privacy Policy explains how Cidade Extremada, trading as hiCalibre, a company incorporated in Portugal under company number 518042758, registered office at Bloco A2, Suite 7, 8650-117, Portugal ("hiCalibre", "we", "us", "our"), collects, uses, and protects personal data of Candidates and Client company contacts who use the hiCalibre platform (the "Service"). It applies alongside the Candidate Terms of Service and Client Terms of Service.
hiCalibre is the data controller for the personal data described below, except where stated otherwise (see Section 8, "When you become a separate controller").
1. Who this applies to
- Candidates - individuals who apply to or hold a profile on the Platform.
- Client contacts - individuals at hiring companies/agencies who create and use a Client account.
2. What personal data we collect
| Data subject | Categories of data | Source |
|---|---|---|
| Candidates | Full name, email, phone (if provided), password (hashed), CV/résumé file, target role and vertical, category, experience level, availability, salary expectations, location, interview notes and recruitment report (hiCalibre tier only), account activity (views, unlocks, introductions) | Provided directly by the Candidate at application and, for interview notes/reports, generated by hiCalibre staff during vetting |
| Client contacts | Full name, work email, company name, password (hashed), stated Hiring Intent (job titles, skills), credit balance and transaction history, billing name/address, and payment metadata via Stripe (we do not receive or store full card numbers) | Provided directly at signup and purchase; payment data collected by Stripe as an independent controller/processor under its own terms |
| All users | Technical data: IP address, device/browser type, log-in timestamps, and similar analytics/security data | Collected automatically via the Platform and hosting infrastructure |
We do not intentionally collect special category data (health, disability, religion, ethnic origin, sexual orientation, trade union membership, criminal record, etc.). If a Candidate voluntarily includes such information in a CV or application (for example, disclosing a disability to request a reasonable adjustment), we will only use it for that specific purpose and apply additional safeguards, with the Candidate's explicit consent where required by law.
3. Why we use your data and our lawful basis
| Purpose | Whose data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Reviewing applications and assigning a Vetted/hiCalibre tier | Candidates | Steps taken at your request prior to a contract (Art. 6(1)(b)) / legitimate interests in operating a vetting marketplace (Art. 6(1)(f)) |
| Displaying (blanked, then unlocked) profiles to Clients | Candidates | Performance of our contract with you (Art. 6(1)(b)) and legitimate interest in operating the marketplace |
| Automated matching ("Matched to your roles") | Candidates, Client Hiring Intent | Legitimate interests in providing a relevant, useful matching feature (Art. 6(1)(f)); see Section 6 on automated decision-making |
| Operating Client accounts, credits, and facilitating Introductions | Client contacts | Performance of our contract with the Client (Art. 6(1)(b)) |
| Processing credit pack payments | Client contacts | Performance of contract (Art. 6(1)(b)); Stripe processes card data under its own legal bases |
| Fraud prevention, security, audit logging | All users | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where applicable |
| Marketing emails about the Platform (optional) | All users | Consent (Art. 6(1)(a)), withdrawable at any time |
| Accounting, tax, and regulatory record-keeping | Client contacts (billing) | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with
We share personal data with:
- Client companies - a Candidate's full profile is shared with a Client once that Client spends credits to Unlock it. Before Unlock, Clients see only blanked/anonymised summary data (experience highlight, salary expectation, location, top skill).
- Sub-processors acting on our instructions, currently: Supabase (database and file hosting), Vercel (application hosting), Stripe (payment processing), Resend (transactional email), and Bullhorn (applicant tracking system used by our admin team), each bound by a data processing agreement.
- Professional advisors and authorities where necessary - for example, our accountants, auditors, legal advisors, or a supervisory/law enforcement authority where legally required.
- A buyer or successor in the event of a merger, acquisition, or asset sale, subject to equivalent protections continuing to apply.
We do not sell personal data to third parties.
5. International data transfers
Some of our sub-processors (for example, hosting or email providers) may store or process data outside the European Economic Area and the UK. Where this happens, we rely on an adequacy decision or, where none exists, the European Commission's Standard Contractual Clauses (and the UK's International Data Transfer Addendum, where relevant to UK-based data subjects), together with additional technical and organisational safeguards where appropriate. You can request a copy of the relevant safeguard at privacy@hicalibre.io.
6. Automated decision-making
The "Matched to your roles" feature and similar ranking/filtering logic use automated processing of profile and Hiring Intent data to decide which Candidates are surfaced to which Clients. This does not result in any final hiring decision, legal effect, or similarly significant effect on you on its own - a human at hiCalibre and, ultimately, the Client, are involved before any hiring outcome occurs. You may ask us to explain the logic behind a specific match by contacting privacy@hicalibre.io; you also have the right under Article 22 GDPR to request human review of any decision you believe was made solely by automated means and had a legal or similarly significant effect on you.
7. How long we keep your data
| Data | Retention |
|---|---|
| Active Candidate/Client profile data | For as long as the account is active, plus 12 months after closure or last activity to allow reactivation and resolve disputes, unless you ask us to delete it sooner and no legal ground requires retention |
| Rejected candidate applications | 6 months from decision, then deleted, unless you consent to being kept on file for future roles |
| Credit transaction / billing records | 10 years, to meet Portuguese tax and accounting retention requirements |
| Security/audit logs | 12 months |
8. When you become a separate controller
Once a Client Unlocks a Candidate's profile and uses that Candidate's data for its own hiring process (outside the Platform - e.g. its own ATS, interview scheduling, or offer process), the Client becomes an independent data controller for that data and is responsible for its own GDPR/UK GDPR compliance regarding that use, including handling any data subject request the Candidate makes directly to the Client about that later use.
9. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- request erasure ("right to be forgotten"), subject to legal retention requirements;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal; and
- lodge a complaint with a supervisory authority - in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt); UK-based individuals may also complain to the Information Commissioner's Office (ICO) (ico.org.uk).
To exercise any of these rights, contact privacy@hicalibre.io. We will respond within one month, extendable by two further months for complex requests, as permitted by law.
10. UK data subjects
Where you are based in the UK, this Policy also describes our processing under the UK GDPR and Data Protection Act 2018.
11. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls limiting staff access to what their role requires, and audit logging of admin actions. No system is completely secure; if a breach occurs that risks your rights and freedoms, we will notify the CNPD (and, where required, affected individuals) within the legally required timeframe (72 hours for the supervisory authority, per Article 33 GDPR).
12. Cookies
The Platform uses essential cookies and similar technologies (such as local storage) strictly necessary for login sessions and platform functionality. We do not currently use advertising or third-party tracking cookies. If we introduce non-essential cookies in future, we will present a consent banner allowing you to accept or reject them in line with the ePrivacy Directive before they are set.
13. Children
hiCalibre is not directed at, and does not knowingly collect data from, anyone under 18. If we learn we have collected data from a minor without appropriate basis, we will delete it.
14. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or in-Platform notice before they take effect.
15. Contact us
Cidade Extremada, trading as hiCalibre - Bloco A2, Suite 7, 8650-117, Portugal
Data protection queries: privacy@hicalibre.io
Questions about these documents? support@hicalibre.io · See also Candidate Terms, Client Terms, Privacy Policy